npm_and_yarn: pnpm v11 multi-document pnpm-lock.yaml reported as dependency_file_not_parseable #14919

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

pnpm@11.0.3

Language version

Node v24.14.1

Manifest location and content before the Dependabot update

app/javascript/package.json:

{
  "engines": { "node": "^24.14.1" },
  "packageManager": "pnpm@11.0.3+sha512.10448f...bccd"
}

app/javascript/pnpm-lock.yaml (truncated; this is a two-document YAML file):

---
lockfileVersion: '9.0'

importers:

  .:
    configDependencies: {}
    packageManagerDependencies:
      '@pnpm/exe':
        specifier: 11.0.3
        version: 11.0.3
      pnpm:
        specifier: 11.0.3
        version: 11.0.3

packages:
  '@pnpm/exe@11.0.3':
    resolution: {integrity: sha512-...}
    hasBin: true
  # ...
snapshots:
  '@pnpm/exe@11.0.3':
    dependencies: { ... }
  # ...

---
lockfileVersion: '9.0'

settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

overrides:
  # ...

importers:
  .:
    dependencies:
      # the actual project dependencies (~750 packages)
    devDependencies:
      # ...
packages:
  # ...
snapshots:
  # ...

What you expected to see, versus what you actually saw

Expected: Dependabot parses the project lockfile (the second YAML document) and proposes updates as usual.

Actual: Every scheduled run for this ecosystem fails immediately with:

+-------------------------------+--------------------------------------------------------------+
| Type                          | Details                                                      |
+-------------------------------+--------------------------------------------------------------+
| dependency_file_not_parseable | {                                                            |
|                               |   "message": "/app/javascript/pnpm-lock.yaml not parseable", |
|                               |   "file-path": "/app/javascript/pnpm-lock.yaml"              |
|                               | }                                                            |
+-------------------------------+--------------------------------------------------------------+

Root cause

This appears to be a separate-but-related issue to #13920 (pnpm lockfileVersion: 9.0). pnpm v11 introduced a new on-disk format where pnpm-lock.yaml is a multi-document YAML file — see the pnpm 11 release notes:

"Resolved versions and integrity hashes have moved from `pnpm-workspace.yaml` to a separate document in `pnpm-lock.yaml`; old inline-hash projects are migrated automatically."

The first YAML document is the "env lockfile" — it stores configDependencies integrity and packageManagerDependencies (the resolved versions of @pnpm/exe and pnpm itself). The second document is the regular project lockfile.

npm_and_yarn/helpers/lib/pnpm/lockfile-parser.ts calls readWantedLockfile from @pnpm/lockfile-file. The first importer in the env document has the new configDependencies / packageManagerDependencies fields and no specifiers field, which the parser doesn't handle. The lockfile is reported as unparseable.

This will affect every project that adopts pnpm 11 (the multi-document layout is the new default; older lockfiles are migrated automatically on install). There's no documented pnpm setting to opt out of the env-lockfile document.

Native package manager behavior

pnpm install reads the lockfile correctly.

Suggested fix direction

Update the pnpm helper to:

1. Read pnpm-lock.yaml as a multi-document YAML when applicable, and use the last document (the project lockfile) as the source of importers / packages / snapshots.
2. Treat the env-lockfile document (configDependencies / packageManagerDependencies) as out-of-scope for dependency updates, or at least not crash on missing specifiers.

Smallest manifest that reproduces the issue

Any pnpm-11–generated pnpm-lock.yaml from a project whose package.json has a packageManager: pnpm@11.x field. A minimal reproduction:

package.json:
{
  \"name\": \"repro\",
  \"private\": true,
  \"packageManager\": \"pnpm@11.0.3+sha512.10448f...\",
  \"dependencies\": { \"lodash\": \"4.17.21\" }
}

Run pnpm install with pnpm 11.0.3 and the resulting pnpm-lock.yaml will be a two-document YAML file that Dependabot fails to parse.